Optimizing docker image encryption—tradeoff between performance and protection level
AssigneeEMC IP Holding Company LLC
InventorsKfir Wolfson, Jehuda Shemer, Stav Sapir, Amos Zamir, Naor Radami
Life of this patent
Estimating the term…
Abstract
One example method includes inserting a signal layer in an image, the signal layer indicating that a sensitive layer in the image is a candidate for encryption, creating a single layer archive file that includes the sensitive layer, encrypting the single layer archive file to create an encrypted layer, constructing a new image that includes the encrypted layer, inserting, in the new image, a decryptor layer that is operable to decrypt the encrypted layer, and designating the decryptor layer as an entry point of the new image.
Claims20
A method, comprising:
- inserting a signal layer in an image which, when instantiated, is executable on an engine that is operable to build and containerize an application, the signal layer indicating that a sensitive layer in the image is a candidate for encryption;
- creating a single layer archive file that includes the sensitive layer;
- encrypting the single layer archive file to create an encrypted layer;
- constructing a new image that includes the encrypted layer;
- inserting, in the new image, a decryptor layer that is operable to decrypt the encrypted layer;
- and
- designating the decryptor layer as an entry point of the new image so that the decryptor layer of the new image runs first when the new image is instantiated.
A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
- inserting a signal layer in an image which, when instantiated, is executable on an engine that is operable to build and containerize an application, the signal layer indicating that a sensitive layer in the image is a candidate for encryption;
- creating a single layer archive file that includes the sensitive layer;
- encrypting the single layer archive file to create an encrypted layer;
- constructing a new image that includes the encrypted layer;
- inserting, in the new image, a decryptor layer that is operable to decrypt the encrypted layer;
- and
- designating the decryptor layer as an entry point of the new image so that the decryptor layer of the new image runs first when the new image is instantiated.
Dependencies are inferred from the claim text.